# A user field on the record

Use a user field when a record belongs to one person, such as a todo and
its owner. A user field is a reference to the user entity, the entity your
app's [principal](the-principal.md) names for the people who
sign in. Naming it in a list, such as `read: [owner_id]`, lets in the user
it points to. A reference to the principal's service entity lets in that
service in the same way.

On the user entity itself, `id` names the caller's own record:
`read: [id]` lets each person read only their own.

## On a create

A create is checked against the new record. So `create: [owner_id]` means
a caller can create a todo only if they are its owner. A request that
names someone else as the owner is refused.

## The field can't be changed by an update

A user field that any list names can't be changed by an ordinary update,
since changing it would hand the record to someone else. You don't mark it
`immutable:` for that. To hand a record to someone else, write a named
action and list it in root `policy.jadpo`, as [Actions](actions.md) shows.